In GSM and WCDMA mobile radio system two basic methods for identifying users of the network exist as specified in 3GPP TS 23.003. The first one is the IMEI (International Mobile station Equipment Identity) for identifying a mobile terminal. This identification is unique; there shall not be two mobile terminals with the same IMEI. The second one is the IMSI (International Mobile Subscriber Identity) for identifying a user of the terminal by means of that user's subscription.
When calling a person however neither of these two are used, instead a third identification; MSISDN (Mobile Subscriber International ISDN Number) is used. Like the IMSI the MSISDN is a unique identification and is coupled to a person's subscription and not the terminal he uses.
The IMEI is hardcoded in the terminal. The IMSI is contained in the SIM (Subscriber Identification Module) card the person adds to his mobile terminal. It is used as internal representation in the GSM or WCDMA network for a person's subscription. The actual subscription details, including but not limited to subscription to basic and supplementary services, are stored in the HLR (Home Location Register). The subscription details in the HLR contain both the IMSI and the MSISDN. By exchanging the SIM card in the mobile terminal the MSISDN and IMSI change relative to this terminal but the IMEI of this terminal remains the same.
When a person switches his terminal on in, or moves with his terminal into, an area covered by a MSC (Mobile Station Controller) that MSC will receive the IMSI stored on the SIM card from the mobile terminal. The MSC will then use the IMSI to contact a HLR using the country code and network code part of the IMSI. The HLR will in return provide the MSISDN to the MSC. When now a call towards that MSISDN is forwarded to the MSC, the MSC knows for which mobile terminal the call is intended.
Referring to FIG. 1 the composition of IMEI, IMSI and MSISDN will be explained. The actual layout is specified in 3GPP TS 23.003.
MSISDN is an ITU-T E.164 number for representing a mobile subscriber. See also ITU-T Recommendation E.213 for a description of MSISDN. This number is used to identify a party wanted for setting up a call to, sending an SMS or referring to in a service request. As GSM/WCDMA systems are subscription based, MSISDN is used for identifying a party. The MSISDN consist of 3 parts; Country Code (CC) of the country in which the user is a subscriber, followed by the National (significant) mobile number, which consists of: National Destination Code (NDC) and Subscriber Number (SN). The MSISDN has a variable length (up to 15 digits).
IMSI is specified in 3GPP TS 23.003, section 2.2. It is also composed of 3 parts comparable to the MSISDN, each digit being a 4 bit decimal (0-9) digit. The 3 parts of the IMSI are;                Mobile Country Code (MCC) consisting of three digits. The MCC identifies uniquely the country of domicile of the mobile subscriber. The allocation of Mobile Country Codes (MCCs) is administered by the ITU-T. The allocation is given in the COMPLEMENT TO ITU-T RECOMMENDATION E.212;        Mobile Network Code (MNC) consisting of two or three digits for GSM/UMTS applications. The MNC identifies the home Public Land Mobile Network (PLMN), within the country identified with the MCC, of the mobile subscriber. The length of the MNC (two or three digits) depends on the value of the MCC. The allocation of MNC is the responsibility of each (national) administration.        Mobile Subscriber Identification Number (MSIN) identifying the mobile subscriber within a PLMN.        
The National Mobile Subscriber Identity (NMSI) consists of the Mobile Network Code and the Mobile Subscriber Identification Number. MCC+MNC of the IMSI uniquely identify a PLMN and can be used for example for the MAP_LOCATION_UPDATE message to identify an HLR in the Home PLMN of a subscriber.
IMEI is specified in 3GPP TS 23.003, section 6. IMEI is a fixed length 15 digit number, each digit being a 4 bit decimal (0-9) digit. Only 14 are of actual use. Digit 15 is for checking purpose only and is not included in air transmission. When transmitting IMEI from the mobile terminal to the network the 15th digit is 0 and an additional filler digit is added to get 16 digits. When transmitted, IMEI digits 15 and 16 can be added, denoting the mobile equipment software version. The 16 digit IMEI with SVN is identified as IMEISV (International Mobile station Equipment Identity and Software Version Number). The checksum calculation is done only over the first 14 digits and is not transmitted from the mobile terminal to the network.
The IMEI consists of following elements;                Type Allocation Code (TAC) identifying manufacturer type/version. Its length is 8 digits. The Type Allocation Code (TAC) is issued by a central body;        Serial Number (SNR) is an individual serial number uniquely identifying each terminal within the TAC. Its length is 6 digits. Manufacturers of GSM/UMTS phones shall allocate individual serial numbers (SNR) in a sequential order.        (optional) Software Version Number (SVN) identifies the software version number of the mobile equipment. Its length is 2 digits.        
IMEI, IMSI and MSISDN are only a few of possible identifications specified for users of the mobile network. For the purpose of this document only those relevant were discussed here. As multiple identifications are possible one needs to specify what type of identification is used to allow the network to recognize the correct address. For that purpose ITU Q.763 (ISUP), 3GPP TS 29.002 (MAP) and 3GPP TS 24.008 (DTAP) specify an address header which contains an identification of the type of address. The identification provides a qualification of the address for the purpose of interpreting the address like when routing a message to a recipient identified by that address.
The identification typically contains;                Nature of Address Identifier (NAI); the NAI identifies the format of the address. In DTAP Type Of Number (TON) is used instead of NAI but is comparable.        Numbering Plan Indicator (NPI); the NPI identifies the (standard) numbering plan applicable for the address like the ITU-T E.164 numbering plan.        
For detailed values and allocation reference should be made to the above mentioned specifications.
When a user of a mobile terminal inserts his SIM card and switches his mobile on the mobile terminal will identify available PLMNs and based on some ruling on the SIM card in co-operation with the networks one PLMN is selected to attach to. This attachment is initiated by a DTAP-Attach message from the mobile terminal to a MSC. A PLMN may have multiple MSCs each covering a specific part of the total coverage area of the PLMN or having overlapping coverage areas. The receiving MSC is responsible for all mobile terminals connected to the PLMN in that specific part. Further referring to FIG. 2, the MSC receives the DTAP-Attach which contain the IMSI as stored on the SIM card. The MSC then acts with sending a MAP_LOCATION_UPDATE message to a HLR (being the own network HLR for a home subscriber or another network HLR for a visiting subscriber as being indicated by the country and network code of the IMSI). The HLR receiving the message will register the location area with the subscription having the corresponding IMSI together with the MSC to address. Where IMSI and MSISDN are static parts of the subscription, location area and the MSC to be addressed are dynamic. The HLR acknowledges the message with a response back to the MSC which includes the MSISDN as contained in the subscription.
When a subscriber is addressed (like setting up a call towards him) the call will initially be set-up to the Gateway MSC (GMSC) in the Home PLMN of that subscriber. The GMSC will interrogate the HLR to find the actual MSC the subscriber is currently connected to. This MSC is commonly noted as Visiting MSC (VMSC), also when it is a MSC in the Home PLMN. The GMSC will forward the call to that VMSC.
When a subscriber is moving he may leave the coverage area of one MSC and move into a coverage area of another MSC (may be also in another PLMN). As for switching on, the other MSC will get a DTAP-attach message with the IMSI as stated on the SIM card. Likewise a message is sent to the relevant HLR specifying the location area and the MSC address. The HLR will update the dynamic data with the new values.
When switching off a mobile terminal or when moving out of MSC coverage area this is notified to the MSC by means of a DTAP-Detach message sent by the mobile terminal to the MSC, which includes again the IMSI. The MSC does not discard immediately the subscriber's subscription data, which the MSC obtained from the HLR, but maintains the data in its internal data store. Instead the MSC sets a timer for this subscription. Reason is that the mobile may be switched on again in short time or may re-enter the coverage area like in border cases. In the later case the mobile would not have performed an explicit detach from the MSC like the mobile does when switched of inside the coverage area. The timer value is a MSC parameter and is commonly set to several hours or a day. When the mobile is switched on again or re-enters the coverage area of the MSC before the timer has expired the timer is cancelled together with sending the MAP_LOCATION_UPDATE message. When however the mobile is not switched on and neither re-enters the coverage area within the maximum duration of the timer, the timer expires and the MSC sends a MAP_PURGE_MS message to HLR indicating that the local registration of the IMSI/MSISDN is discarded.
Entities like MSC and HLR communicate with SS7 messages over a SS7 link. See FIG. 3. They however do not address each other directly. Message transport is facilitated by Signal Transfer Points (STP) performing the message routing in the SS7 network. The entities like MSC and HLR, also denoted as signaling end points (SEP), send outgoing SS7 messages to their closest STP. The SS7 network, comprising STPs as routing nodes interconnected by SS7 links, is underlying to all telecommunication networks and allows a SEP in one network to send messages to a SEP in another network. Although the STP's main function is routing of messages it may have some additional functionality implemented. Examples are number portability (keeping your mobile number when changing your subscription to another operator) and global title translation (generic address translated into a specific address). The STPs are mostly mated pairs to meet stringent reliability requirements. A STP can also be combined with a SEP where that is appropriate.
As can be observed from the above, the network provides only the usage of IMSI or MSISDN for addressing a user, meaning that the subscription is used as means to identify. In most cases this is quite correct as a network user is more coupled to a subscription by means of his SIM card than to a specific terminal. In some cases however this can be quite a nuisance. Some examples;                A person has a SIM card for business purposes and one for private purposes. This relates to the actual charging of the call. The person has only one mobile terminal and SIM cards are swapped with intended use of the terminal. This means however when the business SIM is currently in use, family and friends will get a “terminal switched off” message and likely will be redirected to some voicemail box. In these cases it would be good if one could use the IMEI of the mobile terminal instead so you can reach the persons independent of the SIM he uses at that moment.        A person has a stolen phone and avoids detection in the home network by using another SIM card (e.g. a foreign SIM card). When having the IMEI addressing capability a simple location request would reveal the current location of the stolen phone. In addition a call may be established or an SMS sent to that phone regardless of the SIM card currently in that phone.        Similar is the tracking of known criminals or terrorists that will very frequently replace SIM cards to avoid tracking or lawful intercept. Mostly they are reluctant to change phones as most of their relations are saved on the phone memory. IMEI addressing would make it much easier also as mostly a judge has to provide permission and now that can be done for an IMEI instead of a frequently changing MSISDN.        